PAM TOTP deployment checklist

Before you begin

Test in a disposable VM, snapshot it, keep a root console and an existing SSH session. Back up PAM and SSH configuration.

Install and enrol

sudo apt install libpam-google-authenticator
google-authenticator

sudo integration

Review /etc/pam.d/sudo and any relevant sudo-i service configuration. Add an appropriate required PAM auth rule and test sudo -k followed by sudo id and sudo -i.

SSH integration

Configure PAM carefully and validate the effective OpenSSH settings. A common key-plus-OTP policy uses AuthenticationMethods publickey,keyboard-interactive:pam and KbdInteractiveAuthentication yes, with password login disabled.

Verify

sudo sshd -t
sudo sshd -T -C user=adminuser,host=example,addr=203.0.113.10

Caution

PAM include stacks vary by distribution and release. Do not paste generic PAM lines into production without understanding control flow and recovery. Never publish live QR codes or secrets.